CVE-2026-108750

MEDIUM 4.3

OpenDocMan 2.4.0 through 2.10.0 Decompression Bomb DoS via Upload Text Extraction

CVSS Score

4.3

EPSS Score

0.0%

EPSS Percentile

0th

OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents. Attackers can upload a small ODT, DOCX, or XLSX file whose XML entries decompress to hundreds of megabytes, crashing PHP workers and degrading availability.

CWE	CWE-409
Vendor	opendocman
Product	opendocman
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for opendocman opendocman

Be the first to know when new medium vulnerabilities affecting opendocman opendocman are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

OpenDocMan / OpenDocMan

2.4.0 ≤ 2.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@haind03/opendocman-office-document-decompression-dos github.com: https://github.com/opendocman/opendocman/blob/641f0a6f8eeba902e309978ec04291c44d3cd1c5/application/models/Document.class.php#L67-L75 github.com: https://github.com/opendocman/opendocman/blob/641f0a6f8eeba902e309978ec04291c44d3cd1c5/application/models/TextExtractors/OdtExtractor.class.php#L10-L25 github.com: https://github.com/opendocman/opendocman vulncheck.com: https://www.vulncheck.com/advisories/opendocman-2.4.0-through-2.10.0-decompression-bomb-dos-via-upload-text-extraction

Credits

HaiND from the Post and Telecommunication Institute of Technology